Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions
A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized configuration changes. Endress+Hauser has released a security update addressing this issue.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41690US | — | — | ||
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2025-068: Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions - HTMLself
- CERT@VDE Security Advisories for Endress+Hauserexternal
- VDE-2025-068: Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions - CSAFself
- Endress+Hauserexternal
remediations (2)
- Mitigation
If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.
- Fixed
Endress+Hauser has released a security update addressing this issue.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan